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Abstract — We construct a new secret-key assisted polar coding 
sclieme for private classical communication over a quantum 
or classical wiretap channel. The security of our scheme rests 
on an entropic uncertainty relation, in addition to the channel 
polarization effect. Our scheme achieves the symmetric private 
information rate by synthesizing "amplitude" and "phase" chan- 
nels from an arbitrary quantum wiretap channel. We find that 
the secret-key consumption rate of the scheme vanishes for an 
arbitrary degradable quantum wiretap channel. Furthermore, we 
provide an additional sufficient condition for when the secret key 
rate vanishes, and we suspect that satisfying this condition implies 
that the scheme requires no secret key at all. Thus, this latter 
condition addresses an open question from the Mahdavifar-Vardy 
scheme 1 1 1 for polar coding over a classical wiretap channel. 

Polar coding is one of the most exciting recent developments 
in coding and information theory [2|. The codes are based 
on the channel polarization effect and are provably capacity- 
achieving with an O [N log N) complexity for both encoding 
and decoding, where N is the number of channel uses. 

Several researchers have now extended the polar coding 
method to a variety of scenarios, one of which includes the 
secure transmission of classical data over a wiretap channel 
JT]. The polar codes constructed in Ref. |[T1 meet a "strong 
security" criterion, which requires that the mutual information 
between the sender's information bits and the wiretapper's 
channel outputs decrease to zero as A^ — >^ oo. Guha and 
Wilde later exploited the ideas from Refs. |[ll, O to construct 
polar codes for private data transmission over a quantum 
wiretap channel Q, and the resulting codes achieve the 
symmetric private information rate whenever the channel to 
the wiretapper is classical. 

An important question left open from Ref. [l] is to deter- 
mine if it is possible for the Mahdavifar-Vardy polar coding 
scheme to be both reliable and strongly secure. Ref. IH 
made partial progress on this question by suggesting a simple 
solution: just allow for the sender and receiver to share 
some secret key before communication begins. In spite of 
its simplicity, this solution is undesirable from a practical 
perspective because it might be difficult for the sender and 
receiver to establish good secret key in the first place. Though, 
Proposition 22 in Ref. HI proves that the rate of secret key 
needed vanishes if the wiretap channel is degradable. 

In this paper, we construct a new polar coding scheme 
for private classical communication over a quantum wiretap 
channel. As classical wiretap channels are special cases of 
quantum wiretap channels, all of our results here apply to 
them as well. The security of our scheme has a physical 
basis, due to an entropic uncertainty relation fSl. In fact. 



our scheme is secure in the strongest information-theoretic 
sense, against a wiretapper who has access to unbounded 
quantum computational power. The new scheme offers several 
improvements over the schemes from Refs. |T|, f4l: 

• The net rate of private classical communication is equal to 
symmetric private information for an arbitrary quantum 
channel with qubit input. 

• The secret key consumption rate vanishes for an arbitrary 
degradable quantum wiretap channel. 

• We provide an additional sufficient condition for when 
the secret key rate of our polar coding scheme vanishes 
(it is based on that in Ref. ID — we suspect that satisfying 
this condition means the code does not require any secret 
key bits at all). Since our results here apply to classical 
wiretap channels as well, this result addresses the open 
question from Ref. [1|. We show that the condition is 
satisfied for some example channels (including the one 
from Ref. |[l]) for a wide range of interesting parameters. 

We begin in the next section with some notation and defi- 
nitions. Section [ill overviews our private polar coding scheme 
and proves that it is both reliable and secure if sufficient secret 



key is available. Section III proves that the rate of secret key 



vanishes if the quantum wiretap channel is degradable, and 
the same section provides an additional sufficient condition for 
when the secret key rate of the polar coding scheme vanishes. 



Finally, we conclude in Section IV with a summary. 



I. Notation and Definitions 

A binary-input classical-quantum (cq) channel W : x ^ px 

prepares a quantum state p^ at the output, depending on an 

input classical bit x. Two parameters that determine the per- 
il II 2 

formance of W are the fidelity F {W) = k/Pov^ i ^^^ ^^ 
symmetric Holevo information / {W) = H ((po + Pi) /2) — 
[H {po) + H {pi)] /2 where H {a) = -Trjcrlogjcr} is the 
von Neumann entropy. These parameters generalize the Bhat- 
tacharya parameter and the symmetric mutual information |2|, 
respectively, and are related as / [W) w 1 <^ F [W) ~ and 
/ {W) ^0<^ F (W) w 1 [3]. The channel W is near perfect 
when / (W) w 1 and near useless when / (W) « 0. 

II. Private Polar Coding Scheme 

A. Classical-quantum channels for complementary variables 

Consider a quantum wiretap channel J^"^ -^be ^^ ^ 

with a qubit input system A' for the sender Alice, an output 

system B for the legitimate receiver Bob, and an output 



system E for the wiretapper Eve. The channel M^ ^^ from 
the sender to the legitimate receiver arises by tracing over 
the wiretapper's system: Af^'^^ (p) = TrsiJ^^'^^^ (p)}, 
where p is some qubit input to the channel. Let Uj^ ^ ^ 
denote an isometric extension of this channel |9|, such that 
^2 is its environment. The system ^2 is known as a "shield" 
system ifTOl . ifTTl . which is not available to the wiretapper and 
may or may not be available to the legitimate receiver The 
security of our scheme is in part based on the fact that this 
shield system is not available to the wiretapper. 



This quantum wiretap channel J\f- 



A'^BE 



captures the case 



in which the wiretapper has access to all the physical degrees 
of freedom that are not available to the legitimate receiver (so 
that S2 is a trivial system in this case). It also captures the 
more specialized case in which the output systems B and E 
are classical systems (as in the classical wiretap channel lfT2ll '). 
(See Appendix [A| for a brief discussion of this latter point.) 

Following Ref |13|, we can produce a protocol for sending 
classical information privately over the quantum wiretap chan- 
nel N^ ^BE ^y considering two different complementary 
channels arising from it. Both of these derived channels are cq 
channels that have a classical input bit and a quantum output 
depending on this input bit. 

The first channel that we consider has Alice prepare a 
quantum state p^ depending on the value of an input bit z. 
She then feeds this state into the channel N^ ^^: 



Wa.b -.z^N^ 



'""(pf)- 



(1) 



We call the above channel the "amplitude cq channel," and the 
notation Wa,b indicates that it is an amplitude (A) channel 
to Bob (B). The state pf can generally be a mixed state, 
as would arise, for instance, from using randomness at the 
encoder. It thus admits a purification j-^z) \ which is some 
pure state on a larger tensor-product Hilbert space V,"^ ^V,^'^ 
such that tracing over the purifying system Si gives back the 
original state: pf = Trg^ { IV'z) (V'z I ^ }• The system Si is an 
additional shield system because it represents another system 
that is not available to the wiretapper (though in this case, 
Alice always has access to this shield system). By purifying all 
systems, we can see that the amplitude channel in ([T]i arises by 
tracing over the S1S2E systems of the following cq channel: 



\A 



.BES1S2 



U^^^^'^ l^p. 



\A'Si 



(2) 



The symmetric Holevo information of this amplitude channel 
Wa,b is equal to I (Wa.b) = I{Z',B)^, where the mutual 
information / (Z; B) is computed with respect to 



e 



ZBE 



jEi 



{zf ®u' 



i-BEr A' 



{pi 



(3) 



The second cq channel that we consider is a phase channel 
with quantum side information (QSI). Suppose now that Alice 
has access to an entangled state of the following form: 



b) 



CA'Si _ 



1 

71 



Ei-)''!^^)"'"^ 



(4) 



If so, Alice could then modulate the C system by applying a 
phase operator Z^ to it, depending on some bit x. If she is then 
able to transmit the A' system through the channel N^ ^^ 
and the C and Si systems through an identity channel, the 
resulting channel to Bob is as follows: 



TT/ . ^ V , BCS1S2 



(5) 



The notation Wp^B indicates that this is a phase (P) channel to 
Bob (B). By including the wiretapper E as well, the channel 
acts as follows (where we should subsequently trace over E): 



x^iz^fu^^'^^'^W) 



CA'Si 



-*- \^ / iN^^z I \C I , \BES1S2 



V2 



(6) 



The symmetric Holevo information of this amplitude channel 
Wp^B is equal to I {Wp.b) = I (X; BCS1S2),,, where the 
mutual information is computed using the following state: 



n 



XBCS1S2 



IE 



X ix 



\X 



,BCSiS2 



(7) 



Although it is not immediately obvious, the phase channel 
Wp^B is useful in constructing polar codes for private classical 
communication. Its importance stems from the fact that it is 
intimately related to the amplitude channel from the sender 
to the wiretapper Eve, via an uncertainty relation fSl. Indeed, 
consider the channel from Alice's input bit z to the wiretapper: 



Wa,e ■■ z 



■M^'^^ipf), 



(8) 



where JV^ ^^ is the channel that results from tracing over 
Bob's system after applying the wiretap channel JV"^ -^be ^ 
The notation Wa,e indicates that this channel is an amplitude 
(A) channel to Eve (E). The symmetric Holevo information 
of this channel is equal to / {Wa,e) = I {Z; E).- 

The important uncertainty relation between the channels 
WpB and Wa,e is then as follows: 



1{Wp^b)+1{Wa.e)^\, 



(9) 



which is a special case of Lemma 2 from Ref. ifTSll . We 
interpret the above uncertainty relation as ^'if the phase channel 
to Bob is nearly perfect, then the amplitude channel to Eve 
must be nearly useless and vice versa." 

The above uncertainty relation then enables us to construct 
a reliable and strongly secure polar coding scheme for sending 
private classical data. As outlined in Section |II-C| our scheme 
has the sender transmit private information bits through the 
synthesized channels (in the polar coding sense) that are 
nearly perfect in both amplitude and phase for Bob. The fact 
that these synthesized amplitude channels are nearly perfect 
guarantees that Bob will be able to recover these bits reliably, 
and that these synthesized phase channels are nearly perfect 
for Bob guarantees that Eve will be able to recover only a 
negligibly small amount of information about the bits sent 
through them, due to the above uncertainty relation. 



Partitioning the synthesized channels according to ampHtude 
and phase for Bob, rather than according to ampHtude for Bob 
and ampHtude for Eve as in Refs. |1|, |4|, has the advantage 
that the scheme achieves the symmetric private information 
rate for aH quantum wiretap channels. Moreover, we can 
prove that the secret key consumption rate vanishes for all 
degradable quantum channels, and we can furthermore provide 
an additional sufficient condition for when the secret key rate 
of the polar coding scheme vanishes. 

B. Channel Polarization 

Ref. |3| demonstrated how to construct synthesized versions 
of W , by channel combining and splitting \2A- The synthesized 
channels W^ are of the following form: 



to the following polar coding rule: 



W. 



(0 

N 



Ui -^ P, \ 1 



C/j-iB" 



Pi^) 



^^ 2 



-*- I i-l\ / i- 






(10) 
(11) 



J" ^ >r^ 1 s" 

1 - Z^ 2JV-i^""Gjv' 



pf« = pf; ® 






where Gjv is Arikan's encoding circuit matrix built from 
classical CNOT and permutation gates. If the channel is 
classical, then these states are diagonal in the computational 
basis, and the above states correspond to the distributions for 
the synthesized channels |2|. The interpretation of Wj^ is 
that it is the channel "seen" by the input Ui if the previ- 
ous bits u]~^ are available and if the future bits uf^^^ are 
randomized. This motivates the development of a quantum 
successive cancellation decoder |3| that attempts to distinguish 
Ui = from Mi = 1 by adaptively exploiting the results of 
previous measurements and quantum hypothesis tests for each 
bit decision. 

The synthesized channels Wj^ polarize, in the sense that 
some become nearly perfect for classical data transmission 
while others become nearly useless. To prove this result, one 
can model the channel spHtting and combining process as a 
random birth process 12, 131, and one can demonstrate that the 
induced random birth processes corresponding to the channel 
parameters I{W^ ) and F{W^ ) are martingales that con- 
verge almost surely to zero-one valued random variables in the 
limit of many recursions. The following theorem characterizes 
the rate with which the channel polarization effect takes hold 
lfT4l . 121, and it is useful in proving statements about the 
performance of polar codes for cq channels: 

Theorem 1: Given a binary input c q channel W and any 

/? < 1/2, it holds that lim„^oo VriisjFiW^) < 2-2""} = 
/ (W), where n indicates the level of recursion for the 
encoding, WQ™ i^ ^ random variable characterizing the /* 
split channel, and ^(Wjii ) is the fidelity of that channel. 

Assuming knowledge of the good and bad channels, one can 
then construct a coding scheme based on the channel polar- 
ization effect, by dividing the synthesized channels according 



Gn iW,P) = {ie [N] : ^/m¥) < 2- 



-AfP 



(12) 



and Bn{W,P) = [N] \ gMiW,l3), so that ^jv (M^, /3) is 
the set of "good" channels and Bn {W, /3) is the set of 
"bad" channels. The sender then transmits the information bits 
through the good channels and "frozen" bits through the bad 
ones. A helpful assumption for error analysis is that the frozen 
bits are chosen uniformly at random such that the sender 
and receiver both have access to these frozen bits. Ref. 131 
provided an explicit construction of a quantum successive 
cancellation decoder that has an error probability equal to 
0(2^^ ) — let {-^u^^ } denote the corresponding decoding 
positive operator-valued measure (POVM) ||9l, with ii_4 the 
information bits and u_ac the frozen bits. 

For our polar coding scheme for private communication, 
we can imagine that the classical bits fed into the encoder 
are encoded into the classical states |0) and |1) and that the 
encoder is a coherent, quantum version of Arikan's encoder 
|2], meaning that the gates are quantum CNOTs and per- 
mutations (i.e., the same encoder as in Refs. l6l, l4|)- This 
perspective is helpful in our subsequent analysis of the phase 
channels, though it need not be the case in practice — the 
scheme will work perfectly well if the bits are just classical bits 
and the encoder is Arikan's classical encoder. When sending 
amplitude-basis classical information through the encoder and 
channels, the effect is to induce synthesized channels W)^ j^ 
as described above. Theorem [T] states that the fraction of 



amplitude-good channels (according to the criterion in (12i) 
is equal to / {Z; B),. 

We now consider how the encoder induces synthesized 
channels for the phase-basis classical information. It is im- 
portant to keep in mind for our development in this paper that 
these channels are merely virtual — we just consider them in 
order to relate back to the amplitude channels to Eve via an 
uncertainty relation (this uncertainty relation will be a slightly 
modified version of that in (J9]l). The benefit of this approach 
is that we can broaden the results of Refs. HI, ID and make 
sharper statements about the code's secret key consumption. 

Proceeding similarly to Ref [6|, |15|, the same encoding 
operation leads to channel polarization for the phase channel 
Wp^B as well. Suppose Alice modulates her halves of the 
entangled pairs as in the definition of Wp, but then inputs 
them to the coherent encoder before sending them via the 
channel to Bob. The result is 
1 



/w 



E 

'£{04}' 



(-ir 



\^z 



B"E"S"S!: 



^N 



y 



whose 



uf 



'sfs, 



B' 



x^GZ 



Nr<N 



s^si'c 



U, 



tc^' 



marginal state is simply 
where Us denotes the polar 
encoder Here we have used the fact that the matrix 

corresponding to Gn is invertible. Thus, the coherent encoder 

a) 
also induces synthesized channels Wpj^ using the encoding 

matrix G^ instead of Gn, modulo the additional Ug acting 

on G^ . Theorem fTl states that the fraction of phase-good 



channels to Bob (according to the criterion in (12i) is 
approximately equal to I {X] BCS1S2) 



'V 

Note that the classical side information for the W , 



(i) 
P,N 

is different from that in ( [TO| l because the direction of all 
CNOT gates is flipped due to the transpose of Gn when 
acting on phase variables. This means means that the i* 
synthesized phase channel Wpj^ is such that all of the future 
bits xn ■ ■ ■ Xi+i are available to help in decoding bit Xi while 
all of the previous bits Xi-i ■ ■ ■ xi are randomized. (This is 
the same as described in Ref. |6| for Pauli channels.) 

A clear advantage of the current approach over the previous 
construction from Ref. [4J is that Theorem [T] directly applies to 
the phase-good channels with the "goodness criterion" given 
by ( 12 1. Ref. fH considered the amplitude channels to Eve 



(rather than the phase-good channels to Bob), and it seemed 
only possible to prove polarization results for quantum wiretap 
channels in which the amplitude channel to Eve is classical. 
Our approach here overcomes this difficulty by appealing to 
TheoremfTldirectly for polarization and later relating the phase 
channels to Bob and the amplitude channels to Eve via an 
uncertainty relation (similar to the approach from Ref. |15|). 

C. Private Polar Coding Scheme 

We can now specify our polar coding scheme. Divide 
the synthesized cq amplitude channels W^ ^ ^ into sets 



Gn iWA,B,P) and Bn {Wa,Bi (3) according to ( 12 1, and sim^ 



(i) 



ilarly, divide the synthesized cq phase channels Wp g ^ into 
sets Gn (M/>,b,/3) and Bn (W^p,b,/3), where /3 < V2- The 
synthesized channels correspond to particular inputs to the 
encoding operation, and thus the set of all inputs divides into 
four groups: those that are good for both the amplitude and 
phase variable, those that are good for amplitude and bad for 
phase, bad for amplitude and good for phase, and those that are 
bad for both variables. We denote these channels as follows: 

A = Gn {Wa,b, /3) n Gn (W^p,b, /?) , 
X = gN {Wa,b, P) n Bn [Wp^B.P) , 

Z = BN{WA,B,P)nGN{Wp,B,f3), 
B = BN{WA,B,P)nBN{Wp^B,P)- 

Our polar coding scheme for private classical communi- 
cation has the sender transmit information bits through the 
inputs in A, random bits through the inputs in X, frozen 
bits through the inputs in Z, and halves of secret key bits 
through the inputs in B. It is straightforward to prove that 
the net rate of private classical communication (|^| — \B\) /N 
is equal to the symmetric private information I{Z\B)c — 
I {Z; E)^ by observing that the fraction of amplitude-good 
channels is / {Z; B)^, the fraction of phase-good channels 
is I {X; BCSiS2)„, and exploiting the uncertainty relation 
/ {X; BCSiS2)^ = 1- I{Z- E)^ from (J9l. A detailed proof 
is similar to the proof given in Appendix /^ of Ref. ifTSl . 

We should stress that our consideration of the phase chan- 
nels in this paper is only necessary in order to compute the 
index sets A, X, Z, and B. The decoder in the next section 
does not make explicit use of these phase channels — they 



only arise in our security analysis, where we appeal to an 
entropic uncertainty relation in order to guarantee security of 
the scheme. This is in contrast to our polar coding scheme 
for sending quantum information ifTSl . in which the decoder 
makes explicit use of the phase channels. 

D. Reliability and Security Analysis 

First, it is straightforward to prove that the code has good 
reliability, by appealing to the results from Ref. ID. That is, 
there exists a POVM {AI"^'',!^} such that 



MUc ^ Uc} < 




FiW^^B.N 



^ofi 



,-hNt 



where C = AU X. This POVM is the quantum successive 
cancellation decoder established in Ref. |3|. The quantum 
successive cancellation decoder operates exactly as before, but 
it needs to decode both the information bits in A and the 
randomized bits in A". It also exploits the frozen bits in Z and 
the secret key bits in B to help with decoding. This decoder has 
an efficient implementation if the channel to Bob is classical 
[2J. This is the case for the amplitude damping channel and 
any Pauli channel, for example. 

We now prove that strong security, in the sense of Ref. fT|, 
holds for our polar coding scheme. 

Theorem 2: For sufficiently large N, the private polar cod- 
ing scheme given above satisfies the following strong security 
criterion: / {Ua;E^) = 0(2-3^^^). 
Proof: Consider that 



ieA 



I {Ua;E^) =J2l (U,-E^\U^-] =Y,I {Uf,E^U^- 



ieA 



<j:i{u,,E^un-Y.i(<E,N) 



ieA 



ieA 



The first equality is from the chain rule for quantum mutual 
information and by defining A^ to be the indices in A 
preceding i. The second equality follows from the assumption 
that the bits in U^- are chosen uniformly at random. The first 
inequality is from quantum data processing. The third equality 
is from the definition of the synthesized channels W^^ ^. 
Continuing, we have 



ieA ieA 

<E\/4\/^(<B,^<2E^2^-«(2"^"T 



ieA 



ieA 



The first inequality is from Proposition 1 in Ref. (3]. The 
second inequality follows from a fidelity uncertainty relation 



.(«) 



FiWXE.N)+'2\^FiW}:>)>l 



.('0 



(13) 



proved in Appendix C of Ref. ifTSl . The fourth inequality 
follows from the definition of the set A. ■ 



III. Vanishing Secret-Key Rate 
The rate of secret key required by our polar coding scheme 



>SB 



IS 



vanishes whenever the quantum wiretap channel H^ 
degradable, meaning that there exists some degrading map 
jyB^E jjj^j. ajjows the legitimate receiver to simulate the 



output of the wiretapper: T> 



B^E . 



N 



A'->B 



^N 



A'^E 



This 



condition holds for many channels of interest such as the 
amplitude damping channel and the dephasing channel. 

The argument proceeds similarly to the argument in 
Ref. ifTSJI . The argument there demonstrates that the entan- 
glement consumption rate of a quantum polar code vanishes 
for degradable channels (this argument in turn is similar to 
the original argument in Ref. [1]). We merely highlight the 
argument and point the interested reader to Appendix C of 
Ref 1 15 1 for the details. From the fidelity uncertainty relation 



in ( 13 1, we know that the phase-good channels to Bob should 



be amplitude-"very bad" to Eve, in the sense that 



Fiwl:^s,N 



)<2 



^NP 



^(<k^) 



> 1-2-2 



-N" 



From degradability, we also know that the doubly-bad chan- 
nels in B are amplitude-bad channels to Eve (if they are bad 
for Bob, then they are worse for Eve.). These observations 
imply that the phase-good channels to Bob, the doubly-bad 
channels to Bob, and the amplitude-good channels to Eve are 
disjoint sets. From Theoremfl] the sum rate of the phase-good 
channels to Bob and the amplitude-good channels to Eve is 
equal to I(Wp^b) + I(Wa,e) = 1 as A^ -> oo. Thus, the rate 
of the doubly-bad set is zero in the same limit. 

The theorem below provides another sufficient condition for 
when our private polar code has a vanishing secret key rate. 
The argument proceeds along the lines given in Section 7.1 of 
Ref. im, with the fidelity replacing the Bhattacharya parameter 
We provide a proof in Appendix [B] for completeness. 

Theorem 3: If the following inequality holds, then the pri- 
vate polar coding scheme has a vanishing secret key rate: 



F{Wa,b) + ^F{Wp^b) < 1. 

F{Wa,b) and F{Wp,b) are the fidelities of the amplitude 
channel in (fTh and the phase channel in (J5]), respectively. 

It is our suspicion that channels satisfying the above con- 
dition do not require any secret key at all, but we have 
not been able to prove it (we discuss this point further in 
Appendix iBli. We note that the above theorem provides a 
similar sufficient condition for the quantum polar codes from 
Ref 1 15 1 to determine if the codes there have a vanishing rate 
of entanglement consumption. 

In Appendix O we compute ^yF{WA,B) + \/F{Wp^b) 
for several example channels, including the binary symmetric 
wiretap channel from Ref. |1|, the erasure wiretap channel, 
and the amplitude damping channel. We find that the secret 
key rate vanishes for a wide range of interesting parameters. 

IV. Conclusion 
Building on the general approach from Ref. |fT3]| . we have 
constructed a polar coding scheme for private classical com- 
munication over a quantum wiretap channel which achieves 



the symmetric private information rate. By considering the 
associated classical amplitude and phase channels of the 
wiretap channel, we are able to demonstrate that the scheme is 
both reliable and strongly secure. Indeed, the reliability of non- 
private polar coding is sufficient, as the strong security of the 
private protocol follows from the reliability of the phase chan- 
nel coding. Additionally, we have shown that the secret-key 
consumption rate vanishes for all degradable quantum wiretap 
channels or channels satisfying a simple fidelity criterion. As 
classical wiretap channels are a special form of quantum wire- 
tap channels, all of our results apply to them as well. It would 
be interesting to find an argument ensuring reliability and 
strong security of the scheme which relies only on a classical 
description of the wiretap channel. Further important open 
questions include whether there is an efficient implementation 
of the quantum successive cancellation decoder used here, if 
there is a fast algorithm for determining the good and bad 
channels, and if the condition in Theorem [3] implies that the 
codes require no secret key at all. 
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Appendix A 
Classical Wiretap Channels as Quantum Wiretap Channels 

Suppose that p {y, z\x) is a classical wiretap channel such that x is the input and y and z are the outputs for the legitimate 
receiver and the wiretapper, respectively. Then we can embed the random variables X, Y, and Z into quantum systems, so 
that the resulting wiretap channel has the following action on an arbitrary input state p: 

U^'^^^ [p) ^ 5] (x| p \x) p {y, z\x) \y) (y|^ ® \z) {zf . (14) 

x,y,z 



The physical interpretation of the above channel is that it first measures the input system in the orthonormal basis {\x) {x\} 
(ensuring that the input is effectively classical) and prepares the classical states \y) and \z) for Bob and Eve with probability 
p {y, z\x). One can check that the Kraus operators Q for this classical channel are 

{VF^^;^x)(\yf^\zf){x\^'} . 

Thus, by a standard construction ||9], an isometric extension of this classical wiretap channel acts as follows on a pure state 
input IV'): 

x,y,z 

SO that tracing over system S2 recovers the action of the original channel in ( 14 1 J 

Appendix B 
Proof of Theorem[3] 



As described in Section II-B one can prove that channel polarization takes hold by considering the channel splitting and 
combining process as a random birth process {Wn : n > 0} (with the channel choice picked by some IID Bernoulli process 
{Bn : "^ > 1} and setting Wq — W). One can then consider the induced birth process 



{F„ : n > 0} = yF{W,,) : n > 0} 

for the fidelity channel parameter The inequalities (26-27) from Ref. |3| (an extension of Arikan's inequalities 111) demonstrate 
that the following extremal process {F/^ : n > 0} bounds the actual channel process {F„ : n > 0}: 



^n+l — "I OJ?' J?'2 



F,f if S„=0 

2F^-^2 if ^^^1 , 
a relation which can be written more symmetrically as 

K+i = K if -B« = 0, 

1 - F,;+i = (1 - f;j' if B„ = i. (15) 

From now on, we make abbreviations such as {Fn} — {Fn : n > 0} in order to simplify the notation. 

The extremal process above has the nice property |14„ Observation 4 (ii)] (see the arXiv version) that for every realization 
{bn} of the process {Bn} (and thus for every realization {fn} of {Fn}) there exists a particular initial threshold value F^^ {{bn}) 
such that either 

imi /; = if F(, < f; {{bn}) , 

n— >-oo 

or 

lim /; = 1 if F^ > F; {{bn}) . 

(Note that Fq is deterministic and is the initial value of the process.) 

We can denote the respective fidelity processes for the amplitude and phase channels in our coding scheme as {Fn} and 
{F^} and the respective random birth processes as {Bn} and {Bn}- Also, let {Fjf'} and {Fn'} denote the corresponding 
extremal processes. The important observation made in Ref |6| is that the process {F^} makes the opposite choice of channel 
at each step of the birth process because the phase encoder is the reverse of the amplitude encoder. That is, it holds for every 
n and for every realization {bn} and {6^} that 

' The square root of a probability might seem strange at first glance when appearing in an evolution, but it is in fact quite natural in quantum information 
theory, being inteipreted physically as a probability amplitude. 



Thus, we can write B^ = 1 — Sf, so that B^ is completely determined by i3,f . The extremal amplitude channel process 
{ F^' } is already of the form in (|15|l, and we can consider the extremal phase process as { 1 — F,f ' } in order for it to have 
this same form. Thus, a realization {f^ } of the extremal amplitude channel process {F^'^ converges to one if 

and a realization {1 — /,f } of the extremal phase process |l — F^'} converges to zero if 

i-<'<^U{6;^}), 

implying that {fn'} converges to one if 

F,^'>l-F;Mb^}). 

Thus, the sum process {F,f' + F^'} converges to two if 

Fo^' + F,^'>F;Mb^}) + i-F;Mb^}) 

= 1. (16) 

The above bound is a universal, sufficient lower bound for the sum process to converge to two, that holds regardless of the 
threshold value F^f^{{b^}) for a particular realization \b^}. It follows that a given realization {/^ + /^} of the actual sum 



process JF^ + F,f } can only converge to two when (16i holds because we set F^ = F(^ and the extremal process bounds 
the actual process (note that some realizations might converge to one or zero as well). If a realization {/,f + fn} of ^^^ ^^^ 
process \^F,f + F^} converges to two, then this implies that the set B is non-empty, i.e., the code will require some secret 
key bits. So, if the condition in the statement of the theorem holds, no realization of the sum process can ever converge to 
two, and the code will not require any secret key bits. 

The above argument only holds in the asymptotic limit of many recursions of the encoding such that the channel polarization 
effect takes hold (where all synthesized channels are polarized to be completely perfect or useless). That is, the argument does 
not apply whenever there is a finite number of recursions — in this case, if the number of recursions is large enough, then a 
large fraction of synthesized channels polarize according to some tolerance, but there is always a small fraction that have not 
polarized. Thus, we can only conclude that the above proof applies in the limit of many recursions and that the rate of secret 
key consumption vanishes in this limit. It is an open question to adapt the above argument to the finite case, but we suspect 
that some form of it holds in this regime. 

Appendix C 
Example Channels 

In this appendix, we evaluate the condition from Theorem[3]for several examples, including the independent binary symmetric 
wiretap channel model from Ref [1|, the erasure wiretap channel, and the amplitude damping channel. For many of these 
cases, we find that the resulting polar codes have a vanishing secret key rate for a wide range of parameters. 

A. Binary Symmetric Wiretap Channel 

Suppose that the channel to Bob is a binary symmetric channel with flip probability ps and the channel to Eve is an 
independent binary symmetric channel with flip probability pE- The symmetric private information for this channel is equal to 

(1 - H2 (pb)) -{I-H2 (pe)) = H2 (pe) - H2 (pb) , 
which is only positive whenever pb < Pe- The conditional distribution p{y, z\x) for this channel is just 

p {y, z\x) = {pBf+y (1 - pbY^''^' {peT^'- (1 - PeT^'-^' , (17) 

where Alice inputs x. Bob receives output y. Eve receives output z, and y, z,x e {0, 1}. Observe that the above channel 
factorizes as 

p{y,z\x) = p {y\x) p {z\x) , 

where 

p{y\x)^{PBr^'{i-PBr^'^\ 

Since the amplitude channel to Bob in this case is just a binary symmetric channel with flip probability ps, the root fidelity 
y^FiWAjij just reduces to the classical Bhattacharya parameter: 



F{Wa,b) = 2^pb{1-pb)- 



We now need to compute the fidelity for the phase channel to Bob. Since Alice inputs classical states \z) to the amplitude 
channel, the states \i}jz) in (pi) are just equal to \z) (there is no shield system ^i). This implies that the quantum input for the 
phase channel is of the form 

V / V / 



if x' is the input bit. The isometric extension of this classical wiretap channel is then just 

^ ^p{y,z\x) {\vf ® \zf) {xf ® |x, y, zf^ , 



with p (y, z\x) given by ( 17 1, so that the action on the above input state is 

^'^71 E (-1)''"' Vp iy. Ax) \yf \zf \z'f {x\z'f ® \x, y, zf^ 



x,y,z 

To simplify things, we will write p{x) = 1/2, giving 



-^ Y^ (~i)^'-^ VRy;^ \yf \zf \xf ® k, y, zf' 



a;' -J> E (~^)'' "^ Vpiy,z\x)p{x) \y)^ \z)^ \x)'^ (g) |a;, y, z)^^ 



x,y,z 

Tracing over the E system then gives the phase channel to Bob: 



Trs <! E (-1)''" (-!)"'■"" Vp{y,Ax)p{x)piy",z"W')pix") \y) iv'f U) {^"f l^) i^'f ® N, y, z) (x", y", z"\ 

^ (_!)-'•(-+-") Vp(y,z|x)p(x)p(y",z|x")p(x") |y) (y"!"" ® \x) {x'f ^ \x, y, z) {x" , y" , zf' 



x,y,z,x" ,y" 

J2 (-l)-'-(-+-") ^p{y\x)p{z\x)p{x)p{y''W')p{z\x")p{x") \y) {y"f ^ \x) {x'f <E> \x, y, z) {x" , y", zf 

x,y,z.x" ,y" 

J2 (_i)-'-(-+-") ^p{y\x)p{x\z)p{z)p{y''\x'')p{x''\z)p{z) \y) {y"f ® \x) {x"f ® |x, y, z) {x" , y", zf' 



x,y,z,x ,y 

We can then factorize the above state as follows: 



BCS.S^S, =Y„U) l^.) (v,.,,|^^^-^- ® \z) (zf^ 



where 

Noting that p(z) = 1/2, we now compute the fidehty \/F{Wp,b) as 



F(Wp,i3) = Jf LjBCSxSySz^^BCSxSySz\ 

= 'Y^\/f{Xz,o,Xz,i) 

Z 
Z 

- Ipb - 1/2| , 



0.5 




Positive private 
capacity bound 
No secret key bound 



0.5 



Fig. 1. The parameters pg and pE correspond to bit flip probabilities in the binary symmetric wiretap channel. Below the blue line is the region where the 
symmetric private information is positive. Below the green line is the region for when the secret key rate of the code vanishes according to Theorem l3] The 
result is that the polar code has a vanishing secret key rate for a wide range of interesting parameters pg and p^ ■ 



where the last Une follows from 

\{Xz,o\Xz,i)\ = : 



E (-1)' v/p(y"|2;")p(x"|z)p(y|x)p(x|z) {y"\ \yf {x"\ \xf {x"\ |x)^- {y"\ 

^{-lfp{y\x)p{x\z) 
x,y 

Y,{~lfp{x\z) 



.Sy 



X 

= \PE - 1/2| . 

The relation p {x\z) = p {z\x) follows because p {x) — p{z) ~ 1/2. 

Thus, from Theorem [5] the sufficient condition for the wiretap channel in (17i to have a vanishing secret key rate is just 

2Vpb(1-Pb) + \PE - 1/2| < 1. 
If we assume that pE < 1/2, then this reduces to 



2^/pB{l-pB) < 1/2+PE- 

Figure [T] provides a plot of two bounds: a bound for when the symmetric private information is positive and bound for when 
the polar code has a vanishing secret key rate. We find that the secret key rate vanishes for a wide range of parameters. 

B. Erasure Channel 

An erasure channel transmits the input bit with probability 1 — e and provides an erasure symbol e to the receiver (different 
from or 1) with probability e. A simple model for a channel to the wiretapper is to give the input bit to the wiretapper 
whenever the receiver gets the erasure symbol (thus, the channel to the wiretapper is an erasure channel with erasure probability 

1-e). 

It turns out that this model is equivalent to the quantum erasure channel: 

P^ (l-e)p + e|e)(e|, 

for which it is well known that the complementary channel is just 

p^ep+(l-e)|e)(e|, 



so that this channel is equivalent to the wiretap channel mentioned above. Both the quantum and private capacities of this 
channel are equal to 1 — 2e. 

The amplitude channel to Bob is just an erasure channel with erasure probability e. We now consider the phase channel to 
Bob: 

X -> Af {Z^^ \^) (<i>\ Z"") = eZ^ 1$) ($1 Z^ + (1 - e) TT (g) |e) (e| , 

where tt is the maximally mixed state. It is clear that the above channel is also just an erasure channel with erasure probability 
e because Bob can perform the measurement {|0) (0| + |1) (1| , |e) (e|} on the second qubit to determine if he received the 
state. If he does receive it, he can then perform a Bell measurement to retrieve the bit x. 

Since the root fidelity of an erasure channel is just e, the condition from TheoremlSlfor vanishing secret key rate just reduces 
to 

2e < 1, 

which is satisfied for all erasure probabilities e for which the private information is positive. 

C. Amplitude Damping Channel 

The last example of a channel that we study is the amplitude damping channel. This channel models photon loss when 
transmitting a state in the zero or single-photon subspace over a pure-loss bosonic channel (a beamsplitter with transmissivity 
rf). The Kraus operators for this channel are 

Ao = yr^io)(i|, 

Ai^|0>(0|+y^|l)(l|, 

so that the evolution of an input qubit is 

p^ AqpAI + AipA\. 

This channel has a positive private capacity whenever -q > 1/2. If ?? < 1/2, then the majority of the output is going to the 
wiretapper (or the environment of the channel) and so there is not any positive private capacity for this parameter range. 
The ampUtude channel to Bob is 

O^v4o|0)(0|4 + Ai|0)(0|4 = |0)(0|, 

1 ^ Ao |1) (1| 4 + A,\l) (1| A\ = {l-v) |0) (0| +v\l){l\- 

Thus, the fidelity for this amplitude channel is ^yl — -q. 
Now consider the phase channel: 

where 1$) is the Bell state. Analyzing for this case gives 

(1 - 11) |o) (i| [z^ 1$) ($1 Z-) |i) (o| + (|o) (o| + v/r^ |i> (i|) {z^ l*> (*l z'^) (|o) (o| + v/r^ |i> (i|) 

We handle the first term: 

(1 - r,) |0) (1| (Z- 1$) ($1 Z-) |1) (0| = ^^ |0) (1| (100) (001 + (-if |11) (00| + (-1)^ |00) (11| + |11) (11|) |1> (0| 



V^|io)(io| 



We handle the second term: 



(|o) (o| + y^ |i) (i|) (z- 1$) ($1 Z^) (|0) (0| + v^ |1) (1|) 

= 2 (|0) (0| + ^\l) (1|) (100) (001 + (-1)^ 111) (001 + (-1)^ 100) (111 + 111) (111) (|0) (0| + ^\l) (1|) 

= \ (100) (001 + (-ir V^ 111) (001 + (-If 100) (111 + ^A/ 111) (111) (|0) (0| + ^^ |1) (1|) 

= \ (100) (001 + (-ir V^ 111) (001 + (-If 07 100) (111+7? Ill) (111) 



Adding the two terms gives 



\ (100) (001 + (-1)^ y^ 111) (001 + (-1)^ ^ 100) (111 + ry |11) (11|) + ^ |10) (10| 
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Fig. 2. A comparison of tlie quantity ^F{Wa,b) + v'-F(Wp.s) from Tlieorem 3 and 1 for various transmissivities rj of the amplitude damping channel. 
The result is that a polar code has a vanishing secret key rate for most rj. 



which has the following matrix representation in the computational basis: 







km 
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We numerically compute the fidelity for the phase channel, and the plot in Figure [2] shows all of the damping parameters 
which meet the condition from TheoremIS] The result is that the polar has a vanishing secret key rate for most transmissivities rj. 



